Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach

Link:

The Privacy Commissioner has given Health NZ and patient portal Manage My Health until year to comply with health privacy rules after a massive data breach last year.

Almost 100,000 individuals had data leaked after the portal was targeted by hackers in December.

90 percent of those individuals were based in Northland.

The commissioner had found in May Health NZ and Manage My Health "failed in their responsibilities" to have adequate security controls when hundreds of thousands of medical files were stolen in the cyber attack.

The hackers compromised 403,730 Health NZ documents and 22,609 documents that had been uploaded by patients.

Now, Commissioner Michael Webster has put the two organisations on notice, and set deadlines for them to meet requirements.

The notices were issued for failing to comply at the time of the breach with the security requirements of rule 5 of the Health Information Privacy Code.

The rules required Manage My Health to ensure there were reasonable safeguards to prevent loss, misuse or disclosure of personal information.

Webster noted some changes had already been completed.

Manage My Health had already improved on the effectiveness of multi-factor authentication, as well as restricting user access to information and controlling unauthorised external access, the commissioner's office said.

Webster said he was thinking particularly of Māori in Northland, where 90 percent of the affected patients whose data was stolen live.

"These Compliance Notices will ensure, and confirm to me, that Manage My Health and Health NZ are treating patient data securely and it will give New Zealanders assurance that we take these breaches seriously and that strengthening systems is vitally important," he said.

Manage My Health has until the end of August 2027 to make the changes, while Health NZ has until the end of January.

A patient caught up in the hack, who did not want to be named, told RNZ it was incredibly time consuming, annoying and unprofessional.

She was unsure the 2027 deadlines.

"I'm not sure what is going to take them another year to actually achieve that," the patient said.

"It was all very unclear from the start."

The patient said she'd moved on now, but still did not know what data was leaked.

"I didn't really get the answers I needed," she said.

Post code lottery still alive and well in health sector, latest figures show

Decision to send 12-year-old with 'safety plan' shortly before her death questioned

Health NZ reviewing clinics owned by Tararua Health Group after six staff resign in Pahīatua

Dunedin student drinking issues can't be solved by arrests - local police

Future of Super Rugby and NPC among topics at crunch NZ Rugby summit

Grey Lynn and Ponsonby: From working class roots to Auckland's most sought after suburbs

'No claims': Taxpayers' Union 'categorically denies' sexual harassment payout claim in Nicky Hager book

How Tokomanawa Queens lured WNBA star Hailey Van Lith to NZ women's basketball league

© RNZ, original at